Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- DWORD _kernel32base()
- {
- DWORD *base;
- base = NULL;
- __asm
- {
- MOV ESI, [FS:0x30] //PEB base
- MOV ESI, [ESI + 0x0C] //PEB->Ldr
- MOV ESI, [ESI + 0x1C] //PEB->Ldr.InInitOrder
- _kernel32base_next_module:
- MOV EBP, [ESI + 0x08] //InInitOrder.base_address
- MOV EDI, [ESI + 0x20] //InInitOrder.module_name
- MOV ESI, [ESI] //InInitOrder.flink (next module)
- CMP [EDI + 12*2], 0 //module_name[12] == 0? (unicode)
- JNE _kernel32base_next_module
- MOV base, EBP
- }
- return (DWORD)base;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement